Frank
9c593476af
anubis: pin v1.27.0, fleet-wide cookie domain, persistent signing key
- Image bump v1.13.0 -> v1.27.0 (deploy_anubis pull+tag updated; JSON
policy schema unchanged at this release).
- COOKIE_DOMAIN=franksdank.cloud: the challenge cookie now covers all
guarded *.franksdank.cloud vhosts — solve the PoW once, not per-host.
- ED25519_PRIVATE_KEY_HEX via host env file (0600) with gitea-style
[Service] EnvironmentFile expansion: restarts no longer invalidate
everyone's solved challenges.
- Scratch-verified v1.27.0 before pinning: policy loads, challenge/DENY/
ALLOW all behave, X-Real-Ip now mandatory (chain always sets it).